| Summary: | subversion does not support smartcard | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | jared jennings <jjennings> |
| Component: | coolkey | Assignee: | Bob Relyea <rrelyea> |
| Status: | CLOSED ERRATA | QA Contact: | Chandrasekar Kannan <ckannan> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.0 | CC: | benl, jgalipea |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | coolkey-1_1_0-19_el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-12-06 18:18:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Bug Depends On: | |||
| Bug Blocks: | 747120 | ||
Hah! Relevant: http://www.spinics.net/linux/fedora/coolkey/msg00203.html The fix discussed in the thread above, which worked for me under RHEL5, works for me now under RHEL6 - that being to patch pakchois to pass NULL to C_Initialize instead of the args structure. Wan-Teh Chang suggested in that thread that CoolKey needed some sort of change regarding thread safety. I suppose that would be a more correct fix than to merely stop requesting locking, but as before I will leave it to people who have either more time or more expertise or both. Hmm, I though I had fixed the coolkey locking issue. I know coolkey has locking functions, I don't know why it's throwing the CKR_CANT_LOCK. Passing NULL should be fine, as long as pkchois can handle it's own locking. NSS tries to initiallize modules with locking, and if that fails, NSS marks the module as not-thread-safe and does it's own locking. Since RHEL 6.1 External Beta has begun, and this bug remains unresolved, it has been rejected as it is not proposed as exception or blocker. Red Hat invites you to ask your support representative to propose this request, if appropriate and relevant, in the next release of Red Hat Enterprise Linux. The patch which fixes this for RHEL 6 is the same patch already included in RHEL 5. bob Here's how I verified..
1. Configure an Apache Web server with mod_nss
2. Cause it to require client certificates
<Location /repos>
DAV svn
SVNPath /svn/myrepo
NSSRequireSSL
NSSVerifyClient optional
NSSOptions +OptRenegotiate
NSSRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
3. Go to an RHEL6 workstation and log in.
4. Put the following in $HOME/.subversion/servers:
[global]
ssl-pkcs11-provider = coolkey
3. On the RHEL6 workstation, type..
[root@dhcp231-57 conf.d]# svn ls https://dhcp231-57.rdu.redhat.com/repos/trunk
Passphrase for 'PIN for token "TestUserKDC" in slot "SCM SCR 331 (21120612212405) 00 00"':
dir1/
dir2/
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2011-1738.html |
Description of problem: I have a Subversion server which requires client certificates, and a DoD CAC. Under RHEL6, when I try to use the CAC to authenticate to the server using svn, svn says: svn: Invalid config: unable to load PKCS#11 provider 'coolkey'. It works properly under RHEL5. Also Firefox seems to work properly with the CAC under RHEL6 using CoolKey. Version-Release number of selected component (if applicable): subversion-1.6.11-2.el6.x86_64 neon-0.29.3-1.2.el6.x86_64 pakchois-0.4-3.2.el6.x86_64 coolkey-1.1.0-16.el6.x86_64 Steps to Reproduce: 1. Configure an Apache Web server with mod_ssl and mod_dav_svn. 2. Cause it to require client certificates (SSLVerifyClient require). 3. Go to an RHEL6 workstation and log in. 4. Put the following in $HOME/.subversion/servers: [global] ssl-pkcs11-provider = coolkey 3. On the RHEL6 workstation, type svn ls https://my-server/svn/repository 4. The error results: svn: Invalid config: unable to load PKCS#11 provider 'coolkey'. Actual results: unable to load CoolKey Expected results: successful load of CoolKey, PIN prompt, Subversion transaction successfully completes Additional info: This works properly under RHEL5, with subversion-1.6.11-7.el5 neon-0.25.5-10.el5_4.1 package pakchois is not installed coolkey-1.1.0-15.el5 I tried setting COOL_KEY_LOG_FILE on RHEL6 but got no log file. I straced svn and it opens libcoolkeypk11.so and libckyapplet.so.1, but immediately quits. I installed all the debuginfo packages and ran svn under gdb. Here's what I found: pakchois is calling coolkey's C_Initialize with the CKF_OS_LOCKING_OK flag (pakchois.c:213-216), and CoolKey is throwing a PKCS11Exception(CKR_CANT_LOCK) (coolkey.cpp:215-226). From there the error propagates up from CoolKey through this call stack: #0 load_provider (module=0x7fffffffdab8, name=<value optimized out>, reserved=0x0) at pakchois.c:214 #1 load_module (module=0x7fffffffdab8, name=<value optimized out>, reserved=0x0) at pakchois.c:253 #2 0x00007ffff48d782b in ne_ssl_pkcs11_provider_init (provider=0x7fffffffdba8, name=<value optimized out>) at ne_pkcs11.c:542 #3 0x00007ffff62425f1 in svn_ra_neon__open (session=0x7ffff8228bd0, repos_URL=<value optimized out>, callbacks= 0x7ffff8228b08, callback_baton=<value optimized out>, config=0x7ffff8228d10, pool=<value optimized out>) at subversion/libsvn_ra_neon/session.c:990 #4 0x00007ffff77246b0 in svn_ra_open3 (session_p=0x7fffffffde68, repos_URL= 0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", uuid=0x0, callbacks=0x7ffff8228b08, callback_baton= 0x7ffff8228b58, config=0x7ffff8214d30, pool=0x7ffff8228a88) at subversion/libsvn_ra/ra_loader.c:480 #5 0x00007ffff7ba81b4 in svn_client__open_ra_session_internal (ra_session=0x7fffffffde68, base_url= 0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", base_dir=0x0, base_access=0x0, commit_items=0x0, use_admin=0, read_only_wc=0, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/ra.c:295 #6 0x00007ffff7ba89d1 in svn_client__ra_session_from_path (ra_session_p=0x7fffffffdf40, rev_p=0x7fffffffdf38, url_p=0x7fffffffdf28, path_or_url=0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", base_access=0x0, peg_revision_p=<value optimized out>, revision=0x7fffffffe168, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/ra.c:445 #7 0x00007ffff7b94238 in svn_client_list2 (path_or_url=<value optimized out>, peg_revision=0x7fffffffdff0, revision=<value optimized out>, depth=svn_depth_immediates, dirent_fields=1, fetch_locks=0, list_func= 0x7ffff7fe4f40 <print_dirent>, baton=0x7fffffffe000, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/list.c:134 #8 0x00007ffff7fe4cbf in svn_cl__list (os=<value optimized out>, baton=<value optimized out>, pool= 0x7ffff8214298) at subversion/svn/list-cmd.c:277 #9 0x00007ffff7fe8448 in main (argc=<value optimized out>, argv=<value optimized out>) at subversion/svn/main.c:2119